Article URL: https://www.macrumors.com/2026/09/25/apple-pay-antitrust-lawsuit-advances/ Comments URL: https://news.ycombinator.com/item?id=49857651 Points: 10 # Comments: 0
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
A developer running a QR code service received an unsolicited security report last week flagging an open OAuth dynamic client registration endpoint as a vulnerability. The developer argued the endpoint was functioning as intended, since the Model Context Protocol requires open dynamic registration to allow AI clients like Claude to connect without prior approval. The suggested fixes — requiring access tokens or a redirect URI allowlist — would have effectively disabled MCP support, and the redirect concern was already mitigated by strict per-client checks enforced at both authorization and token exchange. However, investigating the report led the developer to spot a genuine risk: the consent screen displayed the attacker-controlled 'client_name' field as trusted text, enabling anyone to register a client named something like 'QRFLOW Official Support' and craft a convincing phishing page on the real domain. The actual fix addressed how unverified client names were rendered on the consent screen, leaving the registration endpoint itself untouched.
A developer integrating Google's Gemini Agentic Video feature into a LINE Bot found that the mode reduces token consumption by 88% and costs by 66% compared to standard static video processing. Unlike the default static mode, which loads every frame at a fixed sampling rate, agentic mode lets the model selectively scan only relevant video segments to answer specific queries. Testing on a two-hour Google I/O keynote showed the feature could accurately pinpoint timestamped content, such as pricing discussions and product segments. However, the developer discovered four conditions must be met simultaneously for agentic mode to activate: using API version v1beta1, setting the media_processing parameter to AGENTIC, using a supported model, and configuring the thinking_level setting. Critically, if any condition is unmet, the API still returns a successful 200 response with no error, silently falling back to the more expensive static mode.
Steam Deck users running SteamOS often struggle to install Windows-based .exe patches, localization mods, or fan updates because the installers cannot locate game directories hidden within Linux's dot-folder structure. The root causes are hidden folder restrictions under SteamOS and sandbox permission isolation from tools like Bottles or Flatpak applications. A workaround called the 'Relay Transfer Method' involves temporarily copying the game folder to a visible public directory such as Downloads or Desktop, running the patch installer from there, and then copying the patched files back to the original Steam game directory. The method avoids complex terminal commands and works with common compatibility tools like Bottles or Protontricks to launch the .exe installer. Users should also check whether the patch generates a new executable and rename files accordingly to ensure the game launches correctly after patching.
Google officially launched Gemini 3.8 Flash TTS and Gemini 3.8 Flash-Lite TTS on September 22, marking their general availability. A developer used the new text-to-speech API to build a web app that fetches song lyrics, translates them into Chinese, adds phonetic transcriptions for Japanese or Korean, and teaches pronunciation sentence by sentence. The GA release introduced three notable capabilities: text-description-based voice design, voice replication from short recordings with consent watermarking, and per-sentence tone and style control. The two models differ in focus — the flagship targets expressive vocal performance while the Lite variant is optimized for high-volume, cost-efficient generation. The developer noted that while TTS output quality was strong, undocumented implementation details around the new interactions and voices API structure consumed significant development time and daily API quota.
Discussion (0)
Log in to join the discussion and vote.
Log in